NVIDIA NemoClaw Flaw Lets Malicious Sites Poison Local AI Models

Oasis Security has disclosed a significant security vulnerability in NVIDIA NemoClaw that allows a malicious webpage to gain unauthenticated control over a user's local Ollama instance. The flaw creates a direct path for attackers to compromise the integrity of local AI agents by poisoning the models they rely on.

According to the disclosure, identified as CVE-2026-65105, the attack is executed through DNS rebinding. This technique allows a remote, attacker-controlled website to bypass origin checks on the Ollama API, effectively tricking the system into treating the malicious external request as a trusted local one. Once access is gained, the attacker can use the /api/create endpoint to modify the model's Go template. By planting hidden instructions within this template, the attacker poisons the model, altering its behavior without the user's knowledge.

The Integration Gap

NVIDIA NemoClaw integrates with local Large Language Model (LLM) runners, such as Ollama, to provide advanced AI agent capabilities. This architecture relies on a trust relationship between the web-facing agent interface and the local backend service. The vulnerability exploits a lack of robust authentication in this communication chain, allowing a simple web visit to bridge the gap between a browser session and the local system's backend.

Risks to Local AI Integrity

This vulnerability represents a critical risk for developers and users running local AI agents. Because the attack allows for the modification of the model's core instructions, it opens the door to sophisticated prompt injection and potential data exfiltration. Once a model is poisoned, it may follow hidden directives to leak sensitive information or execute unauthorized commands while appearing to function normally to the end user.

The Broader Security Context

As local AI adoption grows, the security of the "last mile" between web interfaces and local backends remains a primary concern. The reliance on local API endpoints without strict authentication creates a surface area for DNS rebinding, a classic web attack that has found new utility in the AI era. When a local service trusts any request coming from the local loopback address, it assumes the browser has already validated the origin—an assumption that DNS rebinding explicitly breaks.

Users are encouraged to monitor for updates to NVIDIA NemoClaw and Ollama that address CVE-2026-65105. Security researchers continue to examine whether similar DNS rebinding patterns exist in other local LLM orchestrators that lack strict origin validation, as the pattern of trusting local API calls is common across many emerging AI tools.